July 2016 - Dillo-dev - lists.mailman3.com

URL field / Loading page images / Refreshing DNS cache
by jgaffney＠lawrenceville.org July 8, 2016

July 8, 2016

Johannes Hofmann <johannes.hofmann at gmx.de> writes: [...] >> > To make the switch to the current snapshot, I had, sadly, to terminate >> > an instance of 3.0.5 that had been running continuously for 90 days >> > without any issues. But to get that much up time it was necessary to >> > add a little code so that SIGUSR1 would call a_Dns_freeall() and >> > a_Dns_init(), otherwise (unless I am missing something) Dillo will >> > persist in using the cached lookup indefinitely and not detect when >> > the IP address has changed. So maybe some sort of key binding could >> > be added that would flush the cache when needed? >> >> good point. However I'd like to avoid another key-binding and rather >> do the right thing automatically. >> I could think of a general DNS entry timeout of a couple of seconds. >> In many cases DNS responses are cached at OS-level too respecting >> lifetime values given by the server. > > Firefox has an option to configure the DNS cache expiration > (network.dnsCacheExpiration). > Attached patch implements a similar feature for Dillo. > > Cheers, > Johannes That was fast! Thanks for this; I will try it out.

1 0

URL field / Loading page images / Refreshing DNS cache: Correction
by jgaffney＠lawrenceville.org July 8, 2016

July 8, 2016

Jorge Arellano Cid <jcid at dillo.org> writes: > Hi John, > > On Thu, Jul 07, 2016 at 05:16:04PM -0400, John Gaffney wrote: >> [...] >> > In the current snapshot, the navigation bar has changed, and the URL >> > field does not seem to be taking into account font_factor -- with the >> > result that the window is smaller than the font height. You can test >> > this by setting, e.g., font_factor=2.0 in your dillorc (most >> > dramatically for a tiny panel with small icons). The issue seems to >> > be with this factor not being taken into account when bh and lh are >> > set in make_panel() in ui.cc. >> [...] >> >> I meant what is actually called the "location box," and on comparing >> the code for 3.0.5 to the snapshot of a few days ago, I see that there >> has been no change in the section of make_panel() in ui.cc that sets >> the values of bh, lh, etc. The change that has caused the problem is >> the addition of line 466 of ui.cc: >> >> i->textsize((int) rint(14.0 * prefs.font_factor)); >> >> But the height of the CustInput i is still set to lh, which does not >> take into account prefs.font_factor. > > Yes man. > > That was a quick patch (#4222 in Hg) for a larger font. > > I'll look at it after I finish a general rendering algorithm bug > I'm working in. > > Please be patient. > > BTW, do you really need a font size that enlarges the location box? or > would it be enough to clamp the font size to fit in? The second case is > a much simpler patch. No rush! I was just pointing out the issue; for myself, just commenting out the above line works just fine by reverting to the old behavior and smaller font size in the location bar.

1 0

URL field / Loading page images / Refreshing DNS cache: Correction
by jgaffney＠lawrenceville.org July 8, 2016

July 8, 2016

[...] > In the current snapshot, the navigation bar has changed, and the URL > field does not seem to be taking into account font_factor -- with the > result that the window is smaller than the font height. You can test > this by setting, e.g., font_factor=2.0 in your dillorc (most > dramatically for a tiny panel with small icons). The issue seems to > be with this factor not being taken into account when bh and lh are > set in make_panel() in ui.cc. [...] I meant what is actually called the "location box," and on comparing the code for 3.0.5 to the snapshot of a few days ago, I see that there has been no change in the section of make_panel() in ui.cc that sets the values of bh, lh, etc. The change that has caused the problem is the addition of line 466 of ui.cc: i->textsize((int) rint(14.0 * prefs.font_factor)); But the height of the CustInput i is still set to lh, which does not take into account prefs.font_factor.

3 2

CSS parser bug
by sgeerken＠dillo.org July 5, 2016

July 5, 2016

Hi! The CSS parser seems to have a bug handling shorthand properties. This example works well, both properties are handled correctly: <body style="background: url(http://www.gnu.org/graphics/heckert_gnu.small.png) repeat-y"> Adding "transparent" (for "background-color"), however, causes the other parts not to be parsed: <body style="background: transparent url(http://www.gnu.org/graphics/heckert_gnu.small.png) repeat-y"> Not a regression, dillo 3.0.5 shows the same behaviour. Sebastian

2 2

trustworthiness of dillo's TLS code at present
by eocene＠gmx.com July 4, 2016

July 4, 2016

Currently I'd trust dillo for https about as much as I'd trust wget for https. (Not that I've really examined wget, but just as a sort of gauge here...) Back in the DPI days, dillo didn't check hostnames on certificates because that was an impossible nightmare with openssl unless you found the code somewhere to modify for your own project. [By the way, there was outrage a couple of years ago when people realized that lots and lots of tools out there, and tls libraries for popular languages, were using OpenSSL and not doing any hostname validation.] It was only with 3.0.5 that I had looked into TLS myself and learned enough about what's insecure at present to disable old ciphers, disable ssl3, disable tls compression. When TLS moved into the browser with the OpenSSL version, I integrated hostname checking code adapted from wget source. And now mbed TLS does the checking itself. At present, our weakness relative to something like chrome or firefox would be in the area of certificate revocation. Dillo has never had a way to know when a certificate has been revoked. For a while, there were certificate revocation lists (CRLs) that are generally published by the assorted certificate authorities, although sometimes you have to click on agreements to get them. The other problem is that those grow _huge_, and distributions don't generally have packages for them (unlike ca-certificates for root certificates). I wouldn't be surprised if the agreements bar distribution. And there was OCSP, which stands for.... Online Certificate Status Protocol. Every time you get a certificate, you query some server, often a third-party server, and ask it whether this certificate is still valid. But those OCSP servers were/are nowhere near reliable enough, and browsers couldn't very well fail everything when the OCSP servers were being flaky.. So OCSP stapling has been coming along, where the OCSP data comes from the original server along with the certificate. OpenSSL has had OCSP code for a little while, but it's very buggy and not documented, and maybe you could get it to work if your application is exceedingly similar to the sample client, but good luck. mbed TLS has OCSP on their roadmap, but it's not implemented yet. As for what the firefoxes and chromes of the world are up to, firefox ripped out their CRL code a while back and they have some other mechanism where certificate authorities notify them of revocations and they push it out. Because they're still big enough to get certificate authorities to do things for them. And they have 'public key pinning' where a server sends keys to certificates, and the client checks that, when certificates are presented in the future, they continue to use one or more of those keys. My understanding is that this is not at all widely used currently. Like if you go to google while claiming that you're chrome, maybe.

1 0